Thursday, September 24
Simple and Free File Examination
I know many people that despise running multiple version of desktop antivirus. One of these programs us usually enough to drop performance to a crawl. For those careful people who like to validate suspect files you get there is a great service VirusTotal.
This service works by accepting uploaded files from users, then running them through a series of tests and virus scanning engines, currently 41 different ones to be exact. This makes it extremely useful for gauging how to treat that questionable email attachment. It manages to do this by making hashes of the files that get uploaded then instead of using additional CPU cycles by scanning duplicate files, just matches the hash then returns the information to the user.
The other really cool part is that it provides detailed file information as well by analyzing the file's actual structure. Someone sends you a .jpg - but really it contains windows executable code ready to infect your machine. Find out what PE information, file structure, and signatures exist within the file.
Best of all the service is free - and actually gets a much better set of core data the more people that use it!